DH was correct; and you were bang on with "the truth is it shocked me" - as it WOULD leave you (or any of us) pretty exposed. That is PRECISELY why there is such tight legislation in this area.
Is wrong on SO many levels.
Legally:
1: Breach of Confidentiality under Employment Laws;
2: Health & Safety Legislation given potential risks (to you and the colleague) given it had/has HUGE potential to make either &/or both of you iller given the other is NOT a health professional; plus the predictable 'risk' of stress - on top of your depression - you could reasonably be assumed to feel as a direct consequence.
3) MASSIVE breaches of Data Protection Act 1998 (DPA 98) - even if was with no 'intent' but simply through casual negligence, is no defence against breach. Worse, personal Health Data falls under the more seriously classed 'Sensitive' class of breaches of DPA 98.
And then there is morally; ethically; respectfully (list endless).
ALL organisations who have data about a 'Data Subject' (you, me, Joe Bloggs) are required to have a Data Officer whose role it is is to ensure all Data is kept within that as demanded by DPA 98; it's 'Data Principles'; and as governed by the Information Commisioner responsible for ensuring compliance with DPA 98 and to whom all complaints should be made.
Without knowing the size of your organisation, it's a bit tricky to be certain but unquestionably I would NOT raise it initially with the Manager who committed the Tort (the 'Civil Wrong' that it is) and now legally referred to as the Torteuss given HAS breached it, but would instead request 1:1 with HR Director and both speak to them as well as handing over a written letter vis the Data Breach.
You are, incidentally, genuinely entitled to Civil Law Damages for any 'injury' suffered, which includes both personal feelings/impact as well as reputional damages.
HTH.
Apols re any typos - am knackered ATM.